The first three bytes of the frame are the destination OUI, while bytes 6 – 8 are the source OUI.Īll you have to do is paste the contents of those three bytes into an online OUI lookup tool in order to confirm Wireshark’s initial results. If for some reason you’re not convinced Wireshark is performing the OUI lookup properly, or you need additional information about the vendor, use the Packet bytes view to pull the code yourself and perform a manual OUI lookup. You can see that Wireshark has already performed an OUI lookup, and is showing the vendor as Raspberr_b1 which correctly identifies the target adapter as being made by Raspberry Pi. Once the session is captured and filtered, click on any captured frame and scroll down to the Ethernet II frame header in the Packet details view. In the example above, I used a display filter to show only the ping reply. One of the easiest ways to perform an OUI lookup on a given host is to ping it.

You need to know the IP address or hostname of the target machine. Wireshark automates OUI lookup, which makes it very easy to identify the vendor of any given network adapter. They registered the card with the IEEE Registration Authority, so AzureWave is the vendor. That’s because AzureWave packaged a Qualcomm chipset onto a PCIe mini card. In the examples below, the OUI vendor shows up as AzureWave, but Qualcomm manufactured the chipset. One caveat to keep in mind is that the OUI denotes the vendor and not the chipset manufacturer. That means the OUI is 54:27:1E and the final three bytes are a unique identifier. To give an example, the MAC address of my laptop is 54:27:1E:44:EC:BA. For instance, if the first three bytes of your network adapter are 3C:FD:FE, your card was sold by Intel. Here’s everything you need to know about OUI in Wireshark.Īn Organizational Unique Identifier (OUI) is a code embedded in the first three bytes of a MAC address. Wireshark makes that information easy to find by performing an automatic OUI lookup on every captured frame. Sometimes it’s useful to know the manufacturer of a given network adapter.

Wireshark mac address filter